The Okta Access Gateway improperly controls the generation of code by failing to sanitize the application label field before incorporating it into the nginx configuration file. This unsanitized input is interpolated directly into an nginx server block directive, which can lead to execution of injected nginx directives. The vulnerability is identified as CVE-2026-78545 with a CVSS 3.1 base score of 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with high privileges to execute arbitrary nginx directives, potentially leading to full compromise of the nginx server configuration, impacting confidentiality, integrity, and availability of the service. The vulnerability does not require user interaction but does require high privileges, limiting the attack surface to privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the application label field and limit privileges to trusted administrators only. Monitor for any vendor updates or official patches addressing this issue.